You are troubleshooting an AP that fails to join a WLC. Which step of the DTLS handshake is first when establishing a secure CAPWAP connection?

The ServerHello message is sent by the server after receiving the ClientHello, in response to the client's initiation.

HelloVerifyRequest is sent by the server as an optional step after receiving the ClientHello, to prevent DoS attacks, and is not the absolute first step.

ChangeCipherSpec messages are exchanged later in the handshake process, typically after key exchange, to signal that subsequent records will be protected under the newly negotiated security parameters.

In the DTLS handshake process, similar to TLS, the client initiates the secure communication by sending a ClientHello message. This message contains information such as the client's supported DTLS version, cipher suites, and a random number, signaling the start of the secure session establishment.